Revolve breach: saved payment card data stolen via automated means on Sept 11; at least 179,259 notified, possibly 1.5M affected
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 04/11/2026 00:01; os links antigos trazem para cá.
Fontes: malwarebytes.com ↗ securityweek.com ↗
Online fashion retailer Revolve (Revolve Group) disclosed in an SEC filing that an unauthorized actor accessed certain systems, including its e-commerce platform, on September 11, 2026. Stolen data includes names, addresses, payment card numbers and expiration dates of customers who had saved a card in their accounts. Notices filed with the Attorney General offices in Iowa, Massachusetts, Texas and Vermont show at least 179,259 people were sent notification letters (securityweek.com). Malwarebytes reports that the Texas filing's underlying data lists a non-public total of 1,515,073 affected nationwide, but Revolve has not confirmed this figure (malwarebytes.com). Revolve says it contained and remediated the incident, notified law enforcement and retained a cybersecurity firm. It reports no operational disruption and no expected material business impact (securityweek.com). No threat actor has publicly claimed responsibility.
Detalhes técnicos
- The intrusion occurred on September 11, 2026 and was discovered on September 29, 2026 (malwarebytes.com, citing the Texas Attorney General filing).
- According to the SEC filing, the attacker is believed to have obtained saved payment data through automated means; the specific technique (e.g., credential stuffing or API abuse) was not disclosed (malwarebytes.com).
- Data exposed: names, addresses, payment card numbers and card expiration dates, only for customers who saved a card in their account.
- The SEC filing does not mention whether CVV codes were exposed, and it is unclear whether card numbers were fully visible or masked (malwarebytes.com). The absence of CVV may limit immediate card-not-present fraud, but the data could still enable fraud or convincing phishing.
- The initial access vector, malware used and the attacker remain undisclosed (securityweek.com).
Remediação
- Review card statements for small unauthorized test charges and unfamiliar merchant names; report fraud immediately to the card issuer.
- Remove saved payment cards from online accounts and request card reissuance with a new number (malwarebytes.com).
- Be cautious of unsolicited calls, texts or emails referencing the breach, as scammers may use the stolen details to appear legitimate (malwarebytes.com).
- Revolve is not offering free identity theft or credit monitoring services (securityweek.com).
Relatos divergentes
- Number of victims: securityweek.com (Nov 2) reports at least 179,259 notified individuals across four states, while malwarebytes.com (Nov 3, more recent) cites a non-public figure of 1,515,073 nationwide in the Texas site's data and 127,200 affected Texans. Revolve has not confirmed the larger figure, so 179,259 is the minimum confirmed count and the 1.5 million figure remains unverified.
Linha do tempo
-
Revolve Data Breach Exposes Payment Card Details of Up to 1.5 Million Customers
ler a análise desta fonte ocultar
Online fashion retailer Revolve Group disclosed that an unauthorized actor accessed customers' saved payment data through automated means, stealing card numbers, expiration dates, names, and addresses. Only customers who had saved a payment card as a method in their Revolve account were affected. According to a filing with the Texas Attorney General, the incident occurred on September 11, 2026 and was discovered on September 29, 2026; the Texas site lists 127,200 affected Texans, while a non-public figure of 1,515,073 appears in the site's underlying data as the total affected nationwide, though Revolve has not confirmed this number. Revolve's SEC filing does not mention whether CVV codes were exposed, and it remains unclear whether card numbers were fully visible or masked. No threat actor or group has publicly claimed responsibility.
Technical Details
The attacker is believed to have obtained the saved payment data through automated means, per Revolve's SEC filing, though the specific technique (e.g., credential stuffing, API abuse) was not disclosed. CVV codes were not mentioned as compromised, which may limit immediate card-not-present fraud risk, though exposed card numbers, expiration dates, and contact details could still enable fraud or more convincing phishing.
Remediation
Affected customers are advised to review card statements for small unauthorized test charges, watch for unfamiliar merchant names, report fraud immediately to their card issuer, remove saved payment cards from online accounts, and request card reissuance with a new number. Users should also be cautious of unsolicited calls, texts, or emails referencing the breach, as scammers may use stolen details to appear legitimate.
-
Revolve e-commerce breach exposes personal and payment card data of at least 179,259 customers
ler a análise desta fonte ocultar
Online fashion retailer Revolve is notifying at least 180,000 individuals that their personal and payment card data was stolen in a breach of its systems, including its online shopping platform. The intrusion occurred on September 11. Revolve contained and remediated it, notified law enforcement and retained a cybersecurity firm. Notices filed with the Attorney General offices in Iowa, Massachusetts, Texas and Vermont show at least 179,259 people were sent notification letters. Revolve has not disclosed who was behind the attack or how they got in, and it says the incident caused no operational disruption and is not expected to have a material impact on its business.
Technical Details
- Unauthorized access to certain systems, including the e-commerce platform, on September 11.
- Data that may have been accessed and exfiltrated: names, addresses, payment card numbers and card expiration dates of customers who had saved this data in their accounts.
- The attacker, initial access vector and malware used have not been disclosed.
- Revolve disclosed the incident in a filing with the US SEC.
Remediation
- Revolve is not offering free identity theft or credit monitoring services.
- Affected individuals are advised to review account statements and watch for fraud or identity theft. Reissuing or monitoring exposed payment cards is a reasonable precaution.